United States Patent and Trademark Office 



UNITED STATES DEPARTME^^T OF COMMERCE 
United States Patent and Trademark Oflice 
Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
www.uspto.gov 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



CONRRMATIONNO. 



09/912,391 



07/26/2001 



Neil John Hursey 



231 17 7590 05/26/2005 

NIXON & VANDERHYE, PC 

901 NORTH GLEBE ROAD, 1 ITH FLOOR 

ARLINGTON, VA 22203 



550-250 



5033 



EXAMINER 



HENNING, MATTHEW T 



ART UNIT 



PAPER NUMBER 



2131 

DATE MAILED: 05/26/2005 



Please find below and/or attached an Office communication concerning this application or proceeding. 



PTO-90C (Rev. 10/03) 



> 

Office Aciinn ^ummarx/ 


Application No. 

09/912,391 


Applicant(s) 

HURSEY ET AL 


Examiner 

Matthew T. Henning 


Art Unit 

2131 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period wrill apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b), 

Status 

1)^ Responsive to communication(s) filed on 07 March 2005 . 
2a)S This action is FINAL. 2b)n This action is non-final. 

3) n Since this application is in condition for allowance except for fomrial matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) M Claim(s) 1-4, 6-12. 14-20 and 22-24 is/are pending in the application. 

4a) Of the above clalm(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) 13 Claim(s) 1-4.6-12.14-20 and 22-24 is/are rejected. 

7) D C!aim(s) is/are objected to. 

B)\Z\ Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9)n The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 31 July 2002 is/are: a)^ accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the cirawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d), 

11) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action orfonm PTO-152. 

Priority under 35 U.S.C. § 119 

12) n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 Certified copies of the priority documents have been received. 

2.n Certified copies of the priority documents have been received in Application No. . 



3.n Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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This action is in response to the communication filed on 3/7/2005. 
DETAILED ACTION 

1. Claims 1-4, 6-12, 14-20, and 22-24 have been examined. Claims 5, 13, and 21 have been 
cancelled. 

2. All objections and rejections not set forth below have been withdrawn. 

Title 

3 . The title of the invention is acceptable. 

Priority 

4. No claim for priority has been made for this application. 

5. The effective filing date for the subject matter defined in the pending claims in this 
application is 07/26/2001. 

Drmnngs 

6. The drawings filed on 7/3 1/2002 are acceptable for examination proceedings. 

Claim Rejections - 35 USC §112 

7. The following is a quotation of the second paragraph of 35 U.S. C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

8. Claims 6, 14, and 22 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
apphcant regards as the invention. Claims 6, 14, and 22 all depend fi-om canceled claims 5, 13, 
and 21 respectively. Therefore, the ordinary person skilled in the art would be unable to 
determine the scope of these claims. Because claims 5, 13. and 21 are now part of dependant 
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claims 1, 9, and 17, the examiner will assume that claims 6, 14, and 22 were meant to depend 
from the independent claims respectively. 

Claim Rejections - 35 USC §102 

9. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language. 

10. Claims 1-3, 5, 7, 9-11, 13, 15, 17-19, 21, and 23 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Marsh (US Patent Number 6.763,462). 

11. Regarding claims 1, 9, and 17, Marsh disclosed a method, apparatus, and program (See 
Marsh Claims) operable to control an e-mail client computer to detect e-mail propagated 
malware (See Marsh Abstract), comprising: e-mail generating logic operable to generate an e- 
mail message (See Marsh Col 2 Lines 1 1-25); comparison logic operable to compare said e-mail 
message with at least one of an address book of a sender of said e-mail message (See Marsh Col. 
1 Lines 61-64 and Col. 2 Lines 44-46) and one or more previously generated e-mail messages 
from said client computer (See Marsh Col. 3 Lines 62-65); and identifying logic operable to 
identify said e-mail message as potentially containing malware if at least one of (i) said e-mail 
message is being sent to more than a threshold number of addressees specified within said 
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address book (See Marsh Col. 1 Lines 61-64 and Col. 2 Lines 44-46, and Col. 3 Lines 13-34); 
(ii) said e-mail message contains message content having at least a threshold level of similarity 
to message content of said previously generated e-mail messages being sent to more than a 
threshold number of addressees specified within said address book; and (iii) said e-mail message 
contains message content having at least a threshold level of similarity to message content of 
more than a threshold number of said previously generated e-mail messages, and quarantine 
queue logic operable to hold said previously generated e-mail messages in a quarantine queue for 
at least a predetermined quarantine period prior to being sent from said client computer (See 
Marsh Col. 3 paragraphs 2-4 wherein Marsh disclosed comparing outgoing messages for a 
certain period of time, two minutes, and if the threshold was reached during that time, the 
message was deleted and not sent, which implied that the message was held for the specified 
period of time before being sent). 

12. Regarding claims 2, 10, and 18, Marsh disclosed that wherein said e-mail message 
specifies a plurality of addressees, said comparison logic being operable to compare said 
plurality of addressees with said e-mail address book to determine if said at least a threshold 
number of addressees has been exceeded (See Marsh Col. 2 Lines 39-46 and Col. 3 Lines 15-34). 

13. Regarding claims 3,11, and 19, Marsh disclosed that said at least a threshold number of 
addressees is specified as a proportion of addressees within said address book (See Marsh Col. 2 
Lines 58-61). 

14. Regarding claims 7, 15, and 23, Marsh disclosed confirmation input logic operable when 
said e-mail message is identified as potentially containing malware to generate a user message 
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seeking a confirmation input fi'om a user of said client computer before said e-mail message is 
sent (See Marsh Col. 3 Lines 35-43). 

Claim Rejections - 35 USC § 103 

15, The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made, 

16. Claims 4, 6, 12, 14, 20, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Marsh as applied to claims 1, 9, and 17 above, and further in view of Bates et al. (US Patent 
Number 6,785,732) hereinafter referred to as Bates. 

Marsh disclosed both a proportion of addresses (See rejection of claim 3 above) and a 
specified time period (See rejection of claim 7 above) but failed to disclose the proportion and 
the time period could be user specified. 

Bates teaches that in a virus checker, a users can specify preferences about the virus 
checking (See Bates Col. 8 Lines 49). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Bates in the virus detector of Marsh by allowing the user to 
specify the proportion and the time period used for determining a threat. This would have been 
obvious because the ordinary person skilled in the art would have been motivated to allow the 
user of the virus checker to specify how the checker would operate. 
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17. Claims 8, 16, and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Marsh as applied to claims 1, 9, and 17 above, and further in view of Kouznetsov (US Patent 
Number 6,725,377). 

Marsh disclosed sending alert an alert to a user upon detection of possible virus activity 
(See Col. 3 Lines 18-22), but failed to disclose sending an alert to an administrator upon 
detection of possible virus activity. 

Kouznetsov teaches that in computer intrusion detection systems, when attack 
characteristics are detected, it is typical to notify an administrator of the detection (See 
Kouznetsov Col. 1 Paragraph 6). . 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Kouznetsov in the virus detection system of Marsh by 
alerting an administrator of detected possible virus activity. This would have been obvious 
because the ordinary person skilled in the art would have been motivated to provide the 
administrator with the knowledge of the possible attack in order for the administrator to take 
appropriate action. 

Response to Arguments 

18. Applicant's arguments filed ^llllQQS have been fully considered but they are not 
persuasive. Applicant's argue primarily that: 

i. Marsh did not disclose holding previously generated email messages in a 
queue for a predetermined period of time prior to being sent from the cUent 
computer. 
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ii. The messages of Marsh are sent prior to comparison and therefore are not 
held, 

19. Regarding applicant's argument i., that Marsh did not disclose holding previously 
generated email messages in a queue for a predetermined period of time prior to being sent from 
the client computer, with respect to claims 1, 9, and 17, the examiner does not find the argument 
persuasive. In Col. 3 of Marsh, Marsh discusses how outgoing email is checked for virus 
activity. As can be seen from Col. 3 Lines 50-65, sent messages are checked for two minutes, 
during which the message recipients are compared in order to determine virus like activity. If 
virus hke activity was detected "the user would again have the options described above regarding 
the disposition of an outgoing message" via a virus warning (See Marsh Col. 3 Lines 54-59). 
These options are described by Marsh in Col. 3 Paragraph 2 wherein the options include, 
"deleting an outgoing message without sending, saving an outgoing message for later 
examination, or disregarding the warning and sending an outgoing message". 

20. In order for the message to have been deleted without sending, it was inherent that the 
message had not been sent prior to the warning. This is because once the message was sent, it 
could not have been deleted without sending. Further, in order for the message to have issued a 
warning it must have been compared during the two minute time window disclosed by Marsh. 
Marsh further disclosed that in the event that no virus activity was detected, the message would 
be delivered according to normal operations of the e-mail application (See Marsh Col. 3 Lines 
18-24). 

21 . It was inherent that in the system of Marsh, the messages were held in a queue until either 
the system deemed them to be virus free or until they were deemed to be suspicious at which 
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point the user could decide to send or not send the message. This is due to the fact that there is 
no way that the message could have been sent and then the user given at a later point in time the 
option to not send the message. The only way to give the user the option, after a time period of 
up to two minutes after the message was deemed "outgoing", to not send a message was to have 
not sent it in the first place, but instead to have stored the message. This storing constitutes a 
queue. Further, the message was stored in the queue prior to sending for a predetermined time 
period, two minutes in the example given by Marsh in Col. 3 Paragraph 4, prior to sending the 
message. Therefore, the examiner does not find the applicant's argument persuasive. 

22. Regarding applicant's argument ii. that the messages of Marsh were sent prior to 
comparison and therefore are not held, has been considered, but the examiner does not find the 
argument persuasive. This is by the same reasoning of the previous paragraph. Further, Marsh 
clearly disclosed not sending the messages until they were deemed virus free (See Marsh Col. 3 
Lines 18-24), and that one way to do so was to monitor the messages sent over the past 
predetermined time period (See Marsh Col. 3 Paragraph 4). Therefore, the examiner does not 
find the applicant's argument persuasive. 

23. As such, the examiner has maintained the rejection of claims 1, 9, and 17 as set forth 
above. The examiner also maintains the rejections of the claims which depend fi"om them, 
claims 2-4, 6-8, 10-12, 14-16, 18-20, and 22-24, for the same reasons. 

24. The examiner would like to note that the new prior art made of record and not relied upon 
is considered pertinent to applicant's disclosure. 

a. Galea (US Patent Application Publication 2002/0004908) disclosed a system m 
which electronic mail was placed in a queue to be scanned prior to sending the message. 



Application/Control Number: 09/912,391 Page 9 

Art Unit: 2131 

b. Gartside (US Patent Number 6,851,058) disclosed that e-mail messages are placed 
in a queue in order to be scanned. 

Conclusion 

25. Claims 1-4, 6-12, 14-20, and 22-24 have been rejected. 

26. The prior art made of record and not relied upon is considered pertinent to apphcant's 
disclosure. 

c. Shipp (Patent Application Pubhcation Number 2004/0054498) disclosed a method 
for detecting a virus outbreak by monitoring e-mail traffic patterns, including monitoring 
for dupUcate or similar messages being sent in a specified period of time. 

d. Hockey (Patent AppUcation Publication Number 2004/00645 1 5) disclosed a 
method for detecting denial of service attacks, worms, and spam by monitoring for 
duplicate messages using message digests, 

e. Algomy et al. (Patent Apphcation publication Number 2002/0194489) disclosed a 
method for containing viruses including monitoring for messages being sent to decoy 
addresses in an address book. 

f Milliken et al. (Patent AppUcation Pubhcation Number 2004/0073617) disclosed 
a method for monitoring e-mail for virus activity involving checking for rephcated 
content. 

27. THIS ACTION IS MADE FINAL. Applicant is remmded of the extension of time 
pohcy as set forth in 37 CFR 1. 136(a). 

A shortened statutory period for reply to this fmal action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
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MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 1 36(a) will be calculated fi*om the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS fi*om the mailing 
date of this final action. 

28. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 
The examiner can normally be reached on M-F 8-4. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an appUcation may be obtained fi"om the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained fi-om either Private PAIR or PubUc PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toU-fi-ee). 




Matthew Henning 
Assistant Examiner 
Art Unit 2131 

^ I ■% y lr\ r\ r\ r- 
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